Pan OS - Paiet/Capstone GitHub Wiki

Basics The Palo Alto firewall uses a command-line interface similar to other firewall devices, with an operational (denoted by the > prompt) and configuration (denoted by the # prompt) mode. To enter configuration mode, simply run configure, and to exit it run exit. Then, browse the configuration tree using show , set configuration keys with set , delete them with delete , and traverse the tree using edit , up to move up one level, and top to return to the top of the tree. Tab-completion can be quite helpful in understanding which nodes are available at each level of the tree. Once changes have been made, run commit to apply them, then save to persist the changes.

Hardware It is recommended to add a virtual serial console to ease administration of the firewall. The Palo Alto firewall supports the serial console, making actions like copying and pasting easier with the VM.

Installation Connect the Palo Alto firewall installation ISO to the virtual CD-ROM drive. Then, boot up the machine, and the firewall will start automatically in live mode. Once booted, log in with the default credentials admin/admin, then run set up and follow the prompts to install to the disk. Once complete, run commit and save, and the Palo Alto firewall will be booted from the disk rather than the live image.

Setup Before configuring services, set the basic system information, including the following steps.

Hostname Run set deviceconfig system hostname to set the system hostname.

Accounts Create a new account by running set mgt-config users user permissions role-based superuser password . When the configuration is committed, the password will be properly hashed and stored in the configuration. Then, run commit and exit configuration mode, and log in with the new user account.

Once logged back in, reenter configuration mode and run delete mgt-config users admin to remove the default user.

Interfaces During first-time setup, browse to the interfaces node with configure, then configure the interfaces.

Zones Palo Alto firewalls use zones to group interfaces that have similar security requirements. Run set zone network layer3 to create a new zone and assign an interface to it.

Security Policies Palo Alto firewalls use security policies to allow or block traffic between zones. A security policy is comprised of a rulebase, and each rule specifies the traffic that it applies to. Run set rulebase security rules to create a new rulebase, then set security policy rules rule to create a new rule.

NAT Policies Palo Alto firewalls use NAT policies to translate IP addresses or ports to different values. A NAT policy is comprised of a rulebase, and each rule specifies the traffic that it applies to. Run set rulebase nat rules to create a new rulebase, then set nat policy rules rule to create a new rule.

Services SSH SSH can be enabled on Palo Alto firewalls by setting an SSH listen address. It also supports a wide range of options, including disabling password authentication.

set service ssh listen-address set service ssh disable-password-authentication

Router Advertisements To support IPv6 addressing using Stateless Address Autoconfiguration (SLAAC), the Palo Alto firewall must be configured to send router advertisements to its connected networks. To configure this, create a router advertisement profile with set network profiles ipv6-router-advertisement , then set the parameters with set network profiles ipv6-router-advertisement prefix and set network profiles ipv6-router-advertisement interface . Finally, apply the router advertisement profile to the interface with set interface <interface